Anomaly correlation mechanism for analysis of handovers in a communication network

ABSTRACT

Optimizing neighbor cell relationships for improving handover performance by interpreting handover failures is presented herein. A method can include receiving data representing a time series of failures of outgoing handovers corresponding to a wireless access point device, and determining, based on a determined condition corresponding to a metric, that a source cell of the wireless access point device is associated with an anomalous cell relation corresponding to the time series of the failures of the outgoing handovers in response to quantifying the time series based on the metric. In various examples, the quantifying can include quantifying the time series with respect to: a volume of the failures during a period of time, an entropy calculated on a probability distribution of the failures by determined relations between the source cell and target cells, and/or an entropy calculated on a probability distribution of determined outgoing handover outcomes.

The subject patent application is a continuation of, and claims priorityto, U.S. patent application Ser. No. 14/090,168, filed Nov. 26, 2013,and entitled “ANOMALY CORRELATION MECHANISM FOR ANALYSIS OF HANDOVERS INA COMMUNICATION NETWORK,” the entirety of which application is herebyincorporated by reference herein.

BACKGROUND

Self organizing network (SON) based technologies, including automaticneighbor relation (ANR) functions, are designed to improve managementand optimization of mobile wireless networks. Such functions includeautomatically adding/removing entries to/from neighbor relation tables(NRTs) that specify neighbor cell relationships for handovers. However,identification, analysis, and interpretation of handover failures hasbeen challenging due to: changing network conditions with respect to theaddition of new cell sites; seasonality effects with respect to time ofday and/or day of week in long term evolution (LTE) wirelesscommunications; and difficulty in identifying root cause(s) of excessivehandover failures with respect to radio frequency (RF) environmentconditions, lack of resources within source and/or target LTE evolvednode Bs (eNodeBs). Consequently, identification of root cause(s) ofhandover failures has had some drawbacks with respect to optimizingneighbor cell relationships for improving handover performance.

BRIEF DESCRIPTION OF THE DRAWINGS

Non-limiting embodiments of the subject disclosure are described withreference to the following figures, wherein like reference numeralsrefer to like parts throughout the various views unless otherwisespecified.

FIG. 1 illustrates a wireless network environment, in accordance withvarious embodiments;

FIG. 2 illustrates a block diagram of a handover anomaly correlationsystem, in accordance with various embodiments;

FIG. 3-7 illustrates plots of information associated with a handoveranomaly correlation system, in accordance with various embodiments;

FIGS. 8-10 illustrate flowcharts of methods associated with a handoveranomaly correlation system, in accordance with various embodiments; and

FIG. 11 is a block diagram representing an illustrative non-limitingcomputing system or operating environment in which one or more aspectsof various embodiments described herein can be implemented.

DETAILED DESCRIPTION

Aspects of the subject disclosure will now be described more fullyhereinafter with reference to the accompanying drawings in which exampleembodiments are shown. In the following description, for purposes ofexplanation, numerous specific details are set forth in order to providea thorough understanding of the various embodiments. However, thesubject disclosure may be embodied in many different forms and shouldnot be construed as limited to the example embodiments set forth herein.

In a SON based LTE based mobile wireless network, performancemeasurements made by a mobile handset (UE) and an evolved node B(eNodeB) are utilized to automatically add/remove entries to/fromneighbor relations tables (NRTs), e.g., data structures withincomponent(s) of an eNodeB that specify neighboring cells for intra-LTEor non-LTE handovers, for facilitation of such handovers. However,identification, analysis, and interpretation of handover failures, e.g.,with respect to an eNodeB, an evolved universal terrestrial radio accessnetwork (EUTRAN) source cell of an eNodeB, etc. has been challenging dueto: changing network conditions with respect to the addition of new cellsites; seasonality effects with respect to time of day and/or day ofweek in long term evolution (LTE) wireless communications; anddifficulty in identifying root cause(s) of excessive handover failureswith respect to radio frequency (RF) environment conditions, lack ofresources within source and/or target LTE evolved node Bs (eNodeBs).

Various embodiments disclosed herein can optimize handover performanceand improve wireless customer experiences by interpreting handoverfailures involving LTE eNodeBs. In this regard, such embodiments canextend current SON capabilities by identifying “heavy-hitter” neighborcell relation(s), e.g., neighbor cell relation(s) that dominate SONhandover failures associated with an eNodeB, e.g., with respect to atotal number of handover failures associated with a EUTRAN cell of aneNodeB, with respect to a total number of handover failures associatedwith the eNodeB, etc., and direct ANR function(s) to remove theheavy-hitter cell relations from respective NRTs.

In one embodiment, a method can receive, by a system comprising aprocessor, data representing a daily, hourly, etc. time series offailures of outgoing handovers corresponding to a wireless access pointdevice, e.g., an eNodeB, etc.—the outgoing handovers are outboundcommunication transfers from a source cell, EUTRAN cell, etc. of theeNodeB to target cells, EUTRAN cells, etc., for example, within theeNodeB, of a neighboring eNodeB, etc.

In an embodiment, the method can quantify the time series based on avolume metric corresponding to the daily, hourly, etc. time series ofthe failures of the outgoing handovers, e.g., with respect to a totalnumber of outgoing handover failures of EUTRAN cells of the eNodeB thatoccur during a determined period of time, e.g., day, week, etc.

In another embodiment, the method can quantify the time series based ona standardized entropy metric corresponding to a standardized entropycalculated on a probability distribution of the failures of the outgoinghandovers by determined relations between the source cell and the targetcells, e.g., by a given EUTRAN cell neighboring cell relation.

In yet another embodiment, the method can quantify the time series basedon a standardized entropy metric corresponding to a standardized entropycalculated on a probability distribution of determined outgoing handoveroutcomes, dispositions, etc., e.g., pass/fail.

In an embodiment, the method can generate, by the system based on thedata, the daily, hourly, etc. time series of failures of the outgoinghandovers, and analyze such time series with respect to weekly/dailyperiodicity, e.g., with respect to daily/hourly variation of outgoinghandover failures within a week/day.

In one embodiment, the method can generate, by the system based on thedata, a daily, hourly, etc. time series associated with the standardizedentropy metric corresponding to the standardized entropy calculated onthe probability distribution of the failures of the outgoing handoversby given EUTRAN cell neighboring cell relation, and analyze such timeseries with respect to weekly/daily periodicity, e.g., with respect to adaily/hourly variation of such standardized entropy metric within aweek/day.

In yet another embodiment, method can generate, by the system based onthe data, a daily, hourly, etc. time series of the standardized entropymetric corresponding to the standardized entropy calculated on theprobability distribution of determined outgoing handover outcomes, andanalyze such time series with respect to weekly/daily periodicity, e.g.,with respect to a daily/hourly variation of such standardized entropymetric within a week/day.

In one embodiment, the method can generate, by the system based adetermined condition corresponding to the volume metric, thestandardized entropy metric corresponding to the standardized entropycalculated on the probability distribution of the failures of theoutgoing handovers by given EUTRAN cell neighboring cell relation,and/or the standardized entropy metric corresponding to the standardizedentropy calculated on the probability distribution of determinedoutgoing handover outcomes, an outgoing handover “threshold crossingalert” representing an existence of anomalous cell relation(s)corresponding to the time series of the failures of the outgoinghandovers.

In another embodiment, the method can generate, by the system, theoutgoing handover threshold-crossing alert using a seasonaldecomposition of the daily, hourly, etc. time series of failures of theoutgoing handovers, of the standardized entropy metric(s) discussedabove, etc. using local regression (LOESS) smoothing procedures. Forexample, the system can generate the threshold-crossing alert based ondetected upward and/or downward spikes in data generated by the LOESSsmoothing procedures.

In an embodiment, based on generation of the outgoing handover thresholdcrossing alert, the method can send a message directed to servicepersonal, technician(s), etc., e.g., alerting the service personal,technician(s), etc. to perform root cause analysis of the anomalous cellrelation(s), e.g., to analyze determined performance metricscorresponding to the source cell. In another embodiment, the method cananalyze, by the system based on the outgoing handover threshold crossingalert, the performance metrics, e.g., determining whether there is aproblem with a cell site backhaul transport, etc. of an associatednetwork, determining whether maintenance was performed, recentlyperformed, etc. on a set of eNodeBs corresponding to the source cell,etc.

In yet another embodiment, in response to determining that the outgoinghandover threshold crossing alert was generated based on the determinedcondition corresponding to the standardized entropy calculated on theprobability distribution of the failures of the outgoing handovers bygiven EUTRAN cell relation, the method can identify, by the system, adominant cell relation, e.g., a “heavy-hitter” neighbor cell relation,of the anomalous cell relation(s) that is dominating SON handoverfailures with respect to the total number of failures of outgoinghandovers corresponding to a source eNodeB, e.g., with respect to atotal number of handover failures associated with a EUTRAN cell of thesource eNodeB, etc.

In one embodiment, the method can determine, identify, etc., by thesystem, the heavy-hitter neighbor cell relation by employing entropybased clustering. In another embodiment, the method can determine,identify, etc., by the system, the heavy-hitter neighbor cell relationby employing a non-parametric outlier detection technique.

In an embodiment, in response to identifying the heavy-hitter neighborcell relation, the method can receive, by the system, incoming handoverdata representing a daily, hourly, etc. time series of failures ofincoming handovers corresponding to a target wireless access pointdevice, target eNodeB, etc. including the target cell—the heavy-hitterneighbor cell relation including the source cell and the target cell,and the incoming handovers are incoming, inbound, etc. communicationtransfers from source cells including the source cell to the targetcell.

In one embodiment, the method can quantify the time series based on anincoming handover volume metric corresponding to the daily, hourly, etc.time series of the failures of the incoming handovers, e.g., withrespect to a total number of incoming handover failures of EUTRAN cellsof the target eNodeB that occur during a determined period of time,e.g., day, week, etc.

In another embodiment, the method can quantify the time series based onan incoming handover standardized entropy metric corresponding to astandardized entropy calculated on a probability distribution of thefailures of the incoming handovers by determined relations between thetarget cell and the source cells, e.g., by a given EUTRAN cellneighboring cell relation.

In yet another embodiment, the method can quantify the time series basedon an incoming handover standardized entropy metric corresponding to astandardized entropy calculated on a probability distribution ofdetermined incoming handover outcomes, dispositions, etc., e.g.,pass/fail.

In an embodiment, the method can generate, by the system based on theincoming handover data, the daily, hourly, etc. time series of failuresof the incoming handovers, and analyze such time series with respect toweekly/daily periodicity, e.g., with respect to daily/hourly variationof incoming handover failures within a week/day.

In one embodiment, the method can generate, by the system based on theincoming handover data, a daily, hourly, etc. time series associatedwith the incoming handover standardized entropy metric corresponding tothe standardized entropy calculated on the probability distribution ofthe failures of the incoming handovers by given EUTRAN cell neighboringcell relation, and analyze such time series with respect to weekly/dailyperiodicity, e.g., with respect to a daily/hourly variation of suchstandardized entropy metric within a week/day.

In yet another embodiment, method can generate, by the system based onthe incoming handover data, a daily, hourly, etc. time series of theincoming handover standardized entropy metric corresponding to thestandardized entropy calculated on the probability distribution ofdetermined incoming handover outcomes, and analyze such time series withrespect to weekly/daily periodicity, e.g., with respect to adaily/hourly variation of such standardized entropy metric within aweek/day.

In one embodiment, the method can generate, by the system based adetermined condition corresponding to the incoming handover volumemetric, the incoming handover standardized entropy metric correspondingto the standardized entropy calculated on the probability distributionof the failures of the incoming handovers by given EUTRAN cellneighboring cell relation, and/or the incoming handover standardizedentropy metric corresponding to the standardized entropy calculated onthe probability distribution of determined incoming handover outcomes,an incoming handover threshold crossing alert representing an existenceof an anomalous cell relation(s) corresponding to the time series of thefailures of the incoming handovers.

In an embodiment, in response to generating the incoming handoverthreshold crossing alert, the method can correlate, by the system,outgoing handover threshold crossing alert(s) corresponding to thesource cell, source eNodeB, source EUTRAN cell, etc. with incominghandover threshold crossing alert(s) corresponding to the target cell,target eNodeB, target EUTRAN cell, etc. with respect to a time period.For example, the method can determine whether all incoming handoversfail at the target eNodeB; whether all incoming handovers fail at thetarget EUTRAN cell during a time corresponding to an outgoing handoverthreshold crossing alert corresponding to the source cell, sourceeNodeB, source EUTRAN cell, etc.; whether all incoming handovers from asource EUTRAN cell fail; and/or whether all incoming handovers from thesource EUTRAN cell to the target EUTRAN cell fail.

In another embodiment, in response to correlating the outgoing handoverthreshold crossing alert(s) with the incoming handover thresholdcrossing alert(s), the method can send, by the system, a messagedirected to service personal, technician(s), etc., e.g., alerting theservice personal, technician(s), etc. to analyze determined performancemetrics corresponding to the target cell, target eNodeB, target EUTRANcell, etc, e.g., for performing a root cause analysis of the anomalouscell relation(s) corresponding to the source cell and the target cell.

In another embodiment, in response to correlating the outgoing handoverthreshold crossing alert(s) with the incoming handover thresholdcrossing alert(s), the method can analyze, by the system, theperformance metrics corresponding to the target cell, target eNodeB,target EUTRAN cell, etc., e.g., determining whether there is a problemwith the target cell, a cell site backhaul transport, etc. of anassociated network, determining whether maintenance was performed,recently performed, etc. on a set of eNodeBs corresponding to the targetcell, etc.

Another embodiment can include a system comprising: a processor; and amemory that stores executable instructions that, when executed by theprocessor, facilitate performance of operations, comprising: receivingdata representing a time series of failures of outgoing handoverscorresponding to a source device, wherein the outgoing handoverscomprise outbound communication transfers from a source cell of thesource device to target cells; and in response to quantifying the timeseries based on a metric, identifying, based on a determined conditioncorresponding to the metric, that the source cell corresponds to ananomalous cell relation, wherein the anomalous cell relation comprisesthe source cell and a target cell of the target cells.

In various embodiments, the quantifying can include quantifying the timeseries with respect to a volume of the failures of the outgoinghandovers during a period of time; quantifying the time series withrespect to a standardized entropy calculated on a probabilitydistribution of the failures of the outgoing handovers by determinedrelations between the source cell and the target cells; and/orquantifying the time series with respect to a standardized entropycalculated on a probability distribution of determined outgoing handoveroutcomes.

In one embodiment, the identifying that the source cell corresponds tothe anomalous cell relation includes determining that the standardizedentropy calculated on the probability distribution of the failures ofthe outgoing handovers by determined relations between the source celland the target cells satisfies the determined condition.

Another embodiment can include a computer-readable storage devicecomprising executable instructions that, in response to execution, causea system comprising a processor to perform operations, comprising:receiving data representing a time series of failures of outgoinghandovers corresponding to a source device, wherein the outgoinghandovers comprise outbound communication transfers from a source cellof the source device to target cells; and in response to quantifying thetime series based on a determined metric, identifying that the sourcecell corresponds to a sets of cells associated with an anomaloushandover failure condition—the set of cells including the source celland a target cell of the target cells.

In an embodiment, the quantifying can include quantifying the timeseries with respect to an entropy calculated on a probabilitydistribution of the failures of the outgoing handovers by determinedrelations between the source cell and the target cells. In oneembodiment, the identifying includes identifying that the set of cellsis an anomalous cell relation using entropy based clustering in responseto determining that an entropy calculated on a probability distributionof the failures of the outgoing handovers by determined relationsbetween the source cell and the target cells satisfies the determinedmetric.

Reference throughout this specification to “one embodiment,” or “anembodiment,” means that a particular feature, structure, orcharacteristic described in connection with the embodiment is includedin at least one embodiment. Thus, the appearances of the phrase “in oneembodiment,” or “in an embodiment,” in various places throughout thisspecification are not necessarily all referring to the same embodiment.Furthermore, the particular features, structures, or characteristics maybe combined in any suitable manner in one or more embodiments.

Furthermore, to the extent that the terms “includes,” “has,” “contains,”and other similar words are used in either the detailed description orthe appended claims, such terms are intended to be inclusive—in a mannersimilar to the term “comprising” as an open transition word—withoutprecluding any additional or other elements. Moreover, the term “or” isintended to mean an inclusive “or” rather than an exclusive “or”. Thatis, unless specified otherwise, or clear from context, “X employs A orB” is intended to mean any of the natural inclusive permutations. Thatis, if X employs A; X employs B; or X employs both A and B, then “Xemploys A or B” is satisfied under any of the foregoing instances. Inaddition, the articles “a” and “an” as used in this application and theappended claims should generally be construed to mean “one or more”unless specified otherwise or clear from context to be directed to asingular form.

As utilized herein, terms “component,” “system,” “interface,” and thelike are intended to refer to a computer-related entity, hardware,software (e.g., in execution), and/or firmware. For example, a componentcan be a processor, a process running on a processor, an object, anexecutable, a program, a storage device, and/or a computer. By way ofillustration, an application running on a server and the server can be acomponent. One or more components can reside within a process, and acomponent can be localized on one computer and/or distributed betweentwo or more computers.

Further, components can execute from various computer readable mediahaving various data structures stored thereon. The components cancommunicate via local and/or remote processes such as in accordance witha signal having one or more data packets (e.g., data from one componentinteracting with another component in a local system, distributedsystem, and/or across a network, e.g., the Internet, with other systemsvia the signal).

As another example, a component can be an apparatus with specificfunctionality provided by mechanical parts operated by electric orelectronic circuitry; the electric or electronic circuitry can beoperated by a software application or a firmware application executed byone or more processors; the one or more processors can be internal orexternal to the apparatus and can execute at least a part of thesoftware or firmware application. As yet another example, a componentcan be an apparatus that provides specific functionality throughelectronic components without mechanical parts; the electroniccomponents can include one or more processors therein to executesoftware and/or firmware that confer(s), at least in part, thefunctionality of the electronic components.

Aspects of systems, apparatus, and processes explained herein canconstitute machine-executable instructions embodied within a machine,e.g., embodied in a computer readable medium (or media) associated withthe machine. Such instructions, when executed by the machine, can causethe machine to perform the operations described. Additionally, thesystems, processes, process blocks, etc. can be embodied withinhardware, such as an application specific integrated circuit (ASIC) orthe like. Moreover, the order in which some or all of the process blocksappear in each process should not be deemed limiting. Rather, it shouldbe understood by a person of ordinary skill in the art having thebenefit of the instant disclosure that some of the process blocks can beexecuted in a variety of orders not illustrated.

Furthermore, the word “exemplary” and/or “demonstrative” is used hereinto mean serving as an example, instance, or illustration. For theavoidance of doubt, the subject matter disclosed herein is not limitedby such examples. In addition, any aspect or design described herein as“exemplary” and/or “demonstrative” is not necessarily to be construed aspreferred or advantageous over other aspects or designs, nor is it meantto preclude equivalent exemplary structures and techniques known tothose of ordinary skill in the art.

The disclosed subject matter can be implemented as a method, apparatus,or article of manufacture using standard programming and/or engineeringtechniques to produce software, firmware, hardware, or any combinationthereof to control a computer to implement the disclosed subject matter.The term “article of manufacture” as used herein is intended toencompass a computer program accessible from any computer-readabledevice, computer-readable carrier, or computer-readable media. Forexample, computer-readable media can include, but are not limited to,magnetic storage devices, e.g., hard disk; floppy disk; magneticstrip(s); optical disk (e.g., compact disk (CD), digital video disc(DVD), Blu-ray Disc (BD)); smart card(s); and flash memory device(s)(e.g., card, stick, key drive); and/or a virtual device that emulates astorage device and/or any of the above computer-readable media.

Artificial intelligence based systems, e.g., utilizing explicitly and/orimplicitly trained classifiers, can be employed in connection withperforming inference and/or probabilistic determinations and/orstatistical-based determinations as in accordance with one or moreaspects of the disclosed subject matter as described herein.

A classifier can be a function that maps an input attribute vector,x=(x1, x2, x3, x4, xn), to a confidence that the input belongs to aclass, that is, f(x)=confidence(class). Such classification can employ aprobabilistic and/or statistical-based analysis (e.g., factoring intothe analysis utilities and costs) to infer an action that a user desiresto be automatically performed. In the case of communication systems, forexample, attributes can be information received from access points,servers, components of a wireless communication network, etc., and theclasses can be categories or areas of interest (e.g., levels ofpriorities). A support vector machine is an example of a classifier thatcan be employed. The support vector machine operates by finding ahypersurface in the space of possible inputs, which the hypersurfaceattempts to split the triggering criteria from the non-triggeringevents. Intuitively, this makes the classification correct for testingdata that is near, but not identical to training data. Other directedand undirected model classification approaches include, e.g., naïveBayes, Bayesian networks, decision trees, neural networks, fuzzy logicmodels, and probabilistic classification models providing differentpatterns of independence can be employed. Classification as used hereincan also be inclusive of statistical regression that is utilized todevelop models of priority.

In accordance with various aspects of the subject specification,artificial intelligence based systems, components, etc. can employclassifiers that are explicitly trained, e.g., via a generic trainingdata, etc. as well as implicitly trained, e.g., via observingcharacteristics of communication equipment, e.g., a gateway, UE, etc.,receiving reports from such communication equipment, receiving operatorpreferences, receiving historical information, receiving extrinsicinformation, etc. For example, support vector machines can be configuredvia a learning or training phase within a classifier constructor andfeature selection module. Thus, the classifier(s) can be used by anartificial intelligence system to automatically learn and perform anumber of functions, e.g., performed by handover anomaly correlationsystem 130 (see below).

As used herein, the term “infer” or “inference” refers generally to theprocess of reasoning about, or inferring states of, the system,environment, user, and/or intent from a set of observations as capturedvia events and/or data. Captured data and events can include user data,device data, environment data, data from sensors, sensor data,application data, implicit data, explicit data, etc. Inference can beemployed to identify a specific context or action, or can generate aprobability distribution over states of interest based on aconsideration of data and events, for example.

Inference can also refer to techniques employed for composinghigher-level events from a set of events and/or data. Such inferenceresults in the construction of new events or actions from a set ofobserved events and/or stored event data, whether the events arecorrelated in close temporal proximity, and whether the events and datacome from one or several event and data sources. Various classificationschemes and/or systems (e.g., support vector machines, neural networks,expert systems, Bayesian belief networks, fuzzy logic, and data fusionengines) can be employed in connection with performing automatic and/orinferred action in connection with the disclosed subject matter.

Further, as used herein, the terms “user,” “subscriber,” “customer,”“consumer,” “operator,” “network maintenance operator,” “administrator,”and the like refer generally to human entities or automated componentssupported through artificial intelligence (e.g., a capacity to makeinference based on complex mathematical formalisms), which can providesimulated vision, sound recognition and so forth.

As utilized herein, the terms “logic,” “logical,” “logically,” and thelike are intended to refer to any information having the form ofinstruction signals and/or data that may be applied to direct theoperation of a processor. Logic may be formed from signals stored in adevice memory. Software is one example of such logic. Logic may also becomprised by digital and/or analog hardware circuits, for example,hardware circuits comprising logical AND, OR, XOR, NAND, NOR, and otherlogical operations. Logic may be formed from combinations of softwareand hardware. On a network, logic may be programmed on a server, or acomplex of servers. A particular logic unit is not limited to a singlelogical location on the network.

Further, the terms “server,” “communication server,” and the like, areutilized interchangeably in the subject application, and refer to anetwork component or appliance that serves and receives data, control,voice, video, sound, gaming, or substantially any data-stream orsignaling-stream to/from other network components, subscriber stations,etc. Data and signaling streams can be packetized or frame-based flows.A network typically includes a plurality of elements that host logic forperforming tasks on the network. The logic can be hosted on servers. Inmodern packet-based wide-area networks, servers may be placed at severallogical points on the network. Servers may further be in communicationwith databases and can enable communication devices to access thecontents of a database. Billing servers, application servers, etc. areexamples of such servers. A server can include several network elements,including other servers, and can be logically situated anywhere on aservice provider's network, such as the back-end of a cellular network.A server can host or can be in communication with a database hosting anaccount for a user of a mobile device. The “user account” includesseveral attributes for a particular user, including a unique identifierof the mobile device(s) owned by the user, relationships with otherusers, application usage, location, personal settings, business rules,bank accounts, and other information. A server may communicate withother servers on different networks to update a user account.

Aspects, features, and/or advantages of the disclosed subject matter canbe exploited in substantially any wireless telecommunication or radiotechnology, e.g., Institute of Electrical and Electronics Engineers(IEEE) 802.XX technology, e.g., Wi-Fi, Bluetooth, etc; worldwideinteroperability for microwave access (WiMAX); enhanced general packetradio service (enhanced GPRS); third generation partnership project(3GPP) long term evolution (LTE); third generation partnership project 2(3GPP2); ultra mobile broadband (UMB); 3GPP universal mobiletelecommunication system (UMTS); high speed packet access (HSPA); highspeed downlink packet access (HSDPA); high speed uplink packet access(HSUPA); LTE advanced (LTE-A), global system for mobile communication(GSM), near field communication (NFC), Wibree, Wi-Fi Direct, etc.

Further, selections of a radio technology, or radio access technology,can include second generation (2G), third generation (3G), fourthgeneration (4G), etc. evolution of the radio access technology; however,such selections are not intended as a limitation of the disclosedsubject matter and related aspects thereof. Further, aspects, features,and/or advantages of the disclosed subject matter can be exploited indisparate electromagnetic frequency bands. Moreover, one or moreembodiments described herein can be executed in one or more networkelements, such as a mobile wireless device, e.g., user equipment (UE),and/or within one or more elements of a network infrastructure, e.g.,radio network controller, wireless access point (AP), etc.

Moreover, terms like “user equipment,” (UE) “mobile station,” “mobilesubscriber station,” “access terminal,” “terminal”, “handset,”“appliance,” “machine,” “wireless communication device,” “cellularphone,” “personal digital assistant,” “smartphone,” “wireless device”,and similar terminology refer to a wireless device, or wirelesscommunication device, which is at least one of (1) utilized by asubscriber of a wireless service, or communication service, to receiveand/or convey data associated with storage of objects within a vehicle,voice, video, sound, and/or substantially any data-stream orsignaling-stream; or (2) utilized by a subscriber of a voice over IP(VoIP) service that delivers voice communications over IP networks suchas the Internet or other packet-switched networks. Further, theforegoing terms are utilized interchangeably in the subjectspecification and related drawings.

Likewise, the terms “local wireless communications cite,” “access point”(AP), “base station,” “Node B,” “eNodeB,” “home Node B” (HNB), “homeaccess point” (HAP), and the like are utilized interchangeably in thesubject specification and drawings and refer to a wireless networkcomponent or apparatus that sends and/or receives data associated withvoice, video, sound, and/or substantially any data-stream orsignaling-stream between a set of subscriber stations—unless contextwarrants particular distinction(s) among the terms. Further, the dataand signaling streams can be packetized or frame-based flows.

A communication network, e.g., wireless network environment 100 (seebelow), for systems, methods, and/or apparatus disclosed herein caninclude any suitable mobile and/or wireline-based circuit-switchedcommunication network including a global systems for mobilecommunication (GSM) network, a time division multiple access (TDMA)network, a code division multiple access (CDMA) network, such as IS-95and subsequent iterations of CDMA technology, an integrated digitalenhanced network (iDEN) network and a public switched telephone network(PSTN). Further, examples of the communication network can include anysuitable data packet-switched or combination datapacket/circuit-switched communication network, wired or wireless IPnetwork such as a VoLTE network, a VoIP network, an IP data network, auniversal mobile telecommunication system (UMTS) network, a generalpacket radio service (GPRS) network, or other communication networksthat provide streaming data communication over IP and/or integratedvoice and data communication over combination datapacket/circuit-switched technologies.

Similarly, one of ordinary skill in the art will appreciate that awireless system e.g., a wireless communication device, UE 102, etc. forsystems, methods, and/or apparatus disclosed herein can include a mobiledevice, a mobile phone, a 4G, etc. cellular communication device, a PSTNphone, a cellular communication device, a cellular phone, a satellitecommunication device, a satellite phone, a VoIP phone, Wi-Fi phone, adual-mode cellular/Wi-Fi phone, a combination cellular/VoIP/Wi-Fi/WiMAXphone, a portable computer, or any suitable combination thereof.Specific examples of a wireless system can include, but are not limitedto, a cellular device, such as a GSM, TDMA, CDMA, IS-95 and/or iDENphone, a cellular/Wi-Fi device, such as a dual-mode GSM, TDMA, IS-95and/or iDEN/VoIP phones, UMTS phones, UMTS VoIP phones, or like devicesor combinations thereof.

FIG. 1 illustrates a wireless network environment 100 that includes ahandover anomaly correlation system 130 that facilitates optimizingneighbor cell relationships by interpreting handover failures, inaccordance with an embodiment. It should be appreciated that althoughhandover anomaly correlation system 130 is illustrated in FIG. 1 as anentity distinct from base station/eNodeB 110, handover anomalycorrelation system 130 can be located/included within and/or across oneor more components, e.g., hardware, software, etc., of wireless networkenvironment 100. For example, in one embodiment, handover anomalycorrelation system 130 can be located within any component(s) of anevolved UMTS terrestrial radio access network (e-UTRA), GSM, and/or UMTScore network, e.g. service provider network 155. Moreover, it should beappreciated that features and advantages of the subject innovation canbe implemented in microcells, picocells, femtocells, or the like,wherein base station/eNodeB 110 can be embodied in an access point.

Each macro cell area 105 represents a “macro” cell coverage area that isserved by a base station/eNodeB 110, e.g., a source or target cell asdescribed above. It should be appreciated that macro cell area 105 isillustrated as a hexagon; however, macro cell area 105 can adopt othergeometries generally dictated by a deployment or topography of the macrocell coverage area, or covered geographic area, e.g., metropolitanstatistical area (MSA), rural statistical area (RSA), etc. Macro cellcoverage is generally intended to serve mobile wireless devices, e.g.,mobile wireless device 120, in outdoor locations. An over-the-airwireless link 115 provides the macro coverage, and wireless link 115comprises a downlink (DL) and an uplink (UL) (both not shown) that canutilize a predetermined band of radio frequency (RF) spectrum associatedwith, e.g., LTE, LTE-A, etc. Accordingly, mobile wireless device 120 canbe an LTE based mobile phone.

Base station/eNodeB 110—including associated electronics, circuitryand/or components—and wireless link 115 form a radio network, e.g.,e-UTRA. In addition, base station/eNodeB 110 communicates with macronetwork platform 108 via backhaul link(s) 151. Macro network platform108 represents a core network comprising one or more cellular wirelesstechnologies, e.g., 3GPP UMTS, GSM, LTE, LTE-A, etc. In one aspect,macro network platform 108 controls a set of base stations/eNodeBs thatserve respective cell(s), EUTRAN cell(s), sectors(s), etc. within and/orbetween the set of base stations, eNodeBs, etc. Macro network platform108 can also communicate with other base stations (not shown) that serveother cells (not shown). Backhaul link(s) 151 can include a wiredbackbone link, e.g., optical fiber backbone, twisted-pair line, T1/E1phone line, synchronous or asynchronous digital subscriber line (DSL),asymmetric DSL (ADSL), coaxial cable, etc.

Packet communication, e.g., voice traffic, data traffic, is typicallyrouted through a broadband wired network backbone (or backhaul network)utilizing, e.g., optical fiber backbone, twisted-pair line, T1/E1 phoneline, synchronous or asynchronous digital subscriber line (DSL),asymmetric DSL (ADSL), coaxial cable, etc. To this end, basestation/eNodeB 110 is typically connected to the backhaul network, e.g.,service provider network 155, via a broadband modem (not shown) andbackhaul link(s) 151. Through backhaul link(s) 151, base station/eNodeB110 can handle substantially any quality of service (QoS) forheterogeneous packetized traffic, e.g., various multiple packet flows.

Base station/eNodeB 110 can integrate into an existing network, e.g.,e-UTRA, GSM, or 3GPP network via various interfaces, for example: via anA-bis interface (not shown) between a base transceiver station (BTS) anda base station controller (BSC); via an Iub interface (not shown)between a radio network controller (RNC) and base station/eNodeB 110;via an interface (not shown) between an RNC and a circuit switched corenetwork (CS-CN); via an interface (not shown) between an RNC and anIu-CS interface; via an interface (not shown) between an RNC and apacket switched core network (or Iu-PS interface); via an interface (notshown) between a BSC and a mobile switching center (MSC) and/or networkswitching subsystem (NNS); via an interface (not shown) between aserving general packet radio service support node (SGSN) and a publicdata network (PDN) (or Gi interface); via an interface (not shown)between an SGSN and other SGSNs (or Gn interface).

Handover relates to transferring a phone call, or communication, inprogress from a source cell to a target cell to avoid terminating ordropping the phone call—the source and target cells associated withmacro cell area 105, for example, or associated with EUTRAN cells withinand/or between macro cell areas 105. Conventionally, two types ofhandover exist: hard handover and soft handover. Hard handover utilizesa break-then-make procedure in which a channel of a source cellassociated with a call is released before another channel in a targetcell is utilized for the call. Soft handover utilizes a make-then-breakprocedure in which the channel of the source cell is used while thechannel of the target cell is used—connection to the target cell isestablished before breaking the connection to the source cell.

In other embodiment(s), wireless network environment 100 can includedata store component(s), a memory configured to store information,and/or computer-readable storage media storing computer-executableinstructions enabling various operations performed via handover anomalycorrelation system 130 and described herein.

Now referring to FIG. 2, handover anomaly correlation system 130 caninclude a data component 210 and an alarm component 220. Data component210 can receive data representing a daily, hourly, etc. time series offailures of outgoing handovers corresponding to base station/eNodeB 110.Further, and referring now to FIG. 3, in one embodiment, data component210 can quantify the time series based on a volume metric correspondingto the daily, hourly, etc. time series, e.g., 310, of the failures ofthe outgoing handovers, e.g., with respect to a total number of outgoinghandover failures of EUTRAN cells of base station/eNodeB 110, withrespect to a total number of outgoing handover failures of a EUTRAN cellof base station/eNodeB 110, etc. that occur during a determined periodof time, e.g., day, week, etc.

In an embodiment, data component 210 can quantify the time series, e.g.,320, based on a standardized entropy metric corresponding to astandardized entropy calculated on a probability distribution of thefailures of the outgoing handovers by determined relations between thesource cell and the target cells, e.g., by a given EUTRAN cellneighboring cell relation.

In one embodiment, data component 210 can quantify the time series,e.g., 330, based on a standardized entropy metric corresponding to astandardized entropy calculated on a probability distribution ofdetermined outgoing handover outcome, disposition, etc., e.g.,pass/fail.

In various embodiments, an entropy H(X) can be determined according toEquation 1 below:

$\begin{matrix}{{{H(X)} = {- {\sum\limits_{x_{i} \in X}\; {{p\left( x_{i} \right)}\log \; {p\left( x_{i} \right)}}}}},} & (1)\end{matrix}$

in which random variable X takes on N_(X) discrete values, X is randomlysampled or observed for m times, P(x_(i))=m_(i)/m, x_(i)εX, m_(i) is thefrequency of X taking the value x_(i), and in which0≤H(X)≤H_(max)(X)=log (min (NX, m)).

Further, a standardized entropy calculated on a probabilitydistribution, e.g., of failures of the outgoing/incoming handovers bydetermined relations, of determined outgoing/incoming handover outcome,etc. can be determined according Equation 2 below:

Standardized Entropy=H(X)/H _(max)(X)  (2)

In one embodiment corresponding to the standardized entropy calculatedon the probability distribution of the failures of the outgoing/incominghandovers by determined relations, X represents eNodeB neighboring cellrelations, x_(i) represents a specific eNodeB neighboring cell relation,m represents number of eNodeB failed handovers, and m_(i) represents anumber of eNodeB failed handovers for a neighboring cell relation i.

In another embodiment corresponding to the standardized entropycalculated on the probability distribution of determinedoutgoing/incoming handover outcome, X represents a value correspondingto handover outcomes with respect to handover requests corresponding toan eNodeB, x_(i) represents a specific handover outcome, e.g.,pass/fail, with respect to a handover request of the handover requests,m represents a number of handover attempts with respect to the eNodeB,and m_(i) represents a number of handovers of a given outcome, e.g.,pass/fail, at the eNodeB.

In yet another embodiment, data component 210 can generate, based on thedata, the daily, hourly, etc. time series of failures of the outgoinghandovers, and analyze such time series with respect to weekly/dailyperiodicity, e.g., with respect to daily/hourly variation of outgoinghandover failures within a week/day.

In one embodiment, data component 210 can generate, based on the data,the daily, hourly, etc. time series associated with the standardizedentropy metric corresponding to the standardized entropy calculated onthe probability distribution of the failures of the outgoing handoversby given EUTRAN cell neighboring cell relation, and analyze such timeseries with respect to weekly/daily periodicity, e.g., with respect to adaily/hourly variation of such standardized entropy metric within aweek/day.

In an embodiment, data component 210 can generate, based on the data,the daily, hourly, etc. time series of the standardized entropy metriccorresponding to the standardized entropy calculated on the probabilitydistribution of determined outgoing handover outcomes, and analyze suchtime series with respect to weekly/daily periodicity, e.g., with respectto a daily/hourly variation of such standardized entropy metric within aweek/day.

In this regard, alarm component 220 can identify, based a determinedcondition corresponding to the volume metric, the standardized entropymetric corresponding to the standardized entropy calculated on theprobability distribution of the failures of the outgoing handovers bygiven EUTRAN cell neighboring cell relation, and/or the standardizedentropy metric corresponding to the standardized entropy calculated onthe probability distribution of determined outgoing handover outcomes,an outgoing handover “threshold crossing alert” representing anexistence of an anomalous cell relation(s) corresponding to the timeseries of the failures of the outgoing handovers.

In yet another embodiment, alarm component 220 can generate the outgoinghandover threshold crossing alert by decomposing a time series, e.g., ofa number of outgoing handover failures, etc. into three components: a) atrend component representing low frequency (e.g., seasonal or strictlyperiodic) variation in the data such as variation/seasonality among 24hourly observations within a period corresponding to a day,variation/seasonality among 7 daily observations within a periodcorresponding to a week, etc.; b) a non-stationary, long term change inlevel, e.g., a trend; and c) a remainder/residual component representingthe remaining variation in the data after the seasonal and trendcomponents are removed.

For example, decomposition of the time series can be implemented via asequence of local regression (LOESS) smoothings. LOESS is procedure thatcan be used for fitting a polynomial surface (e.g., quadratic surface)for each predicted point using only nearby data points (e.g., byweighted least squares) to ensure that “local” data points are mostinfluential. In one embodiment, a seasonal (e.g., hourly/daily)component for the specified period (e.g., day/week) can be generated;seasonal values can be removed; and the remainder smoothed based onLOESS to find the trend. The overall level is then removed from theseasonal component and then added to the trend component. The remaindercomponent is defined as the residuals from the seasonal plus the trendfit.

If the data, the trend component, the seasonal component, and theremainder component are denoted by Yv, Tv, Sv and R v, for v=1, . . . ,N, then: Yv=Tv+Sv+Rv, in which seasonality is modeled as an additive,and not a multiplicative, component. In this regard, by examining a timeseries in which the seasonal component is removed, e.g., Yv−Sv=Tv+Rv,upward and downward spikes in Yv-Sv can be analyzed to generate athreshold crossing alert, e.g., an outgoing handover threshold crossingalert, an incoming handover threshold crossing alert, etc.

In an embodiment, alarm component 220 can utilize a Holt-Winters'three-parameter exponential smoothing model (see Equation 3) to generatea threshold crossing alert, e.g., the outgoing handover thresholdcrossing alert, an incoming handover threshold crossing alert (seebelow), etc. Such model can assume that a time series can be decomposedinto three components:

y _(t)=(b ₁ +b ₂ t)S _(t)+ε_(t),  (3)

with b₁=overall mean, b₂=linear trend, and S_(t)=seasonal trend.

In this regard, in one embodiment, alarm component 220 can adaptivelyadjust a threshold at which the threshold crossing alert can begenerated given the following:

Let μ represent the current estimate of the overall mean.

Let S_(i) represent the current estimate of the seasonality factor fortime interval i, that is, the mean of a particular interval in relationto the overall mean.

For example, if the daily mean traffic volume is 50 GB/hour, but themean traffic volume at 2:00 pm is 75 GB/hour, the seasonality factorS_(2:00 pm)=75/50=1.5 (assuming a daily cycle or period).

Let Var represent the current estimate of the overall normalizedvariance (e.g., the variance if there were no seasonality effects).

Variance is assumed to be approximately proportional to the seasonalityfactor or, equivalently, the mean, e.g., the variance expected to belarger if the mean is higher, so that an estimate of the variance for agiven time interval i would be S_(i)Var.

A threshold range, including an upper control limit (UCL) and a lowercontrol limit (LCL) will be wider during peak intervals and narrowerduring non-peak intervals as opposed to a threshold that assumes fixedvariance according to Equations 4 and 5:

UCL=(S _(i)μ)+(THRESHOLD_LEVEL*sqrt(S _(i)*Var)),  (4)

LCL=(S _(i)μ)−(THRESHOLD_LEVEL*sqrt(S _(i)*Var)).  (5)

Given a new data point, X, e.g., a measured or observed value of anumber of outgoing/incoming handover failures, a derived value of astandardized entropy calculated on a probability distribution offailures of outgoing/incoming handovers by neighboring cell relation, aderived value of a standardized entropy calculated on a probabilitydistribution of determined outgoing/incoming handover outcome, etc. fora time interval i, e.g., day of week, alarm component 220 can determinean estimated baseline S_(i), e.g., an expected number ofoutgoing/incoming handover failures, an expected value of thestandardized entropy calculated on the probability distribution of thefailures of the outgoing/incoming handovers by neighboring cellrelation, an expected value of the standardized entropy calculated onthe probability distribution of the outgoing/incoming handover outcome,etc. for the time interval i, with an estimated variance of S_(i)Var.

Further, alarm component 220 can determine, calculate, etc. a deviationscore, D, which represents a measure of the deviation of X from theestimated baseline according to Equation 6:

$\begin{matrix}{D = {\frac{\left( {X - {S_{i}\mu}} \right)}{{\sqrt{S}}_{i}{Var}}.}} & (6)\end{matrix}$

In an embodiment, alarm component 220 can normalize the deviation scorefor mean, seasonality, e.g., day of week, and variance.

If THRESHOLD_LEVEL is the level at which alarm component 220 generatesthe threshold crossing alert, then alarm component 220 can generate thethreshold crossing alert when D>THRESHOLD_LEVEL or D<−THRESHOLD_LEVEL.

In another embodiment, alarm component 220 can calculate new estimatesfor the above parameters using Equations 7 to 11:

$\begin{matrix}{{\mu_{New} = {{{\alpha\theta}\frac{X}{S_{i}}} + {\left( {1 - {\alpha\theta}} \right)\mu}}},} & (7) \\{{S_{\,_{i}{New}} = {{{\beta\theta}\frac{X}{\mu}} + {\left( {1 - {\beta\theta}} \right)S_{i}}}},} & (8) \\{{{Var}_{New} = {\max\left( {{{{\gamma\theta}\; {S_{i}\left( {\frac{X}{S_{i}} - \mu} \right)}^{2}} + {\left( {1 - {\gamma\theta}} \right){Var}}},{{Min}\; {SD}^{2}}} \right)}},{with}} & (9) \\{{i = {{interval}\mspace{14mu} {of}\mspace{14mu} {cycle}}},{and}} & (10) \\{{0 < \alpha},\beta,{\gamma < \frac{1}{\theta}},{{{Min}\; {SD}} > {0\mspace{11mu} {\left( {{minimum}\mspace{14mu} {SD}} \right).}}}} & (11)\end{matrix}$

Further, after a check for handover anomalies, e.g., after determiningwhether there is a threshold crossing alert, alarm component 220 canperform adaptive thresholding by updating the above parameters accordingto Equation 12:

μ=μ_(New) , S _(i) =S _(iNew), Var=Var_(New)  (12)

In one embodiment, during a “ramp up phase”, e.g., in which handoverestimates are unknown or unstable, alarm component 220 can set a ramp-upfactor θ>1, e.g., to give current handover observations more weight, tospeed up convergence, etc. Further, during the ramp-up phase, alarmcomponent 220 does not generate outgoing/incoming handover alert(s),alarm(s), etc.

In another embodiment, alarm component 220 can determine the thresholdcrossing alert utilizing an exponential smoothing model, e.g., based onEquations 1-12, etc. that normalizes a measure of a deviation of datarepresenting a number of outgoing/incoming handover failures from anestimated, expected, etc. baseline, or number, etc. of expectedoutgoing/incoming handover failures, e.g., based on a mean, seasonality,e.g., day of week, variance, etc.

Now referring to FIG. 3, plot 310 represents a number of daily outgoinghandover failures at a source eNodeB corresponding to neighboring ANRcreated EUTRAN cells. In this regard, alarm component 220 can generatean outgoing handover threshold crossing alert at 318 in responsedetermining that the number of daily outgoing handover failures during aperiod of time, e.g., a day, exceeds, is above, etc. UCL 312, which canbe computed by alarm component 220 per Equation 4 above. It should beappreciated that 314 and 316 correspond to observed handover failuresand expected handover failures, respectively.

In another embodiment, plot 320 represents a time series of astandardized entropy calculated on a probability distribution of thefailures of the outgoing handovers by given EUTRAN cell neighboring cellrelation. In this regard, alarm component 220 can generate the outgoinghandover threshold crossing alert at 329 in response to determining thatthe standardized entropy calculated on the probability distribution ofthe failures of the outgoing handovers by given EUTRAN cell neighboringcell relation is below LCL 328, which can be computed by alarm component220 per Equation 5 above.

In yet another embodiment, plot 330 represents a time series of astandardized entropy calculated on a probability distribution ofdetermined outgoing handover outcomes, e.g., pass/fail. In this regard,alarm component 220 can generate the outgoing handover thresholdcrossing alert at 338 in response to determining that the standardizedentropy of the probability distribution of outgoing handover outcome isabove UCL 332, which can be computed by alarm component 220 per Equation4 above.

In an embodiment, based on detection of the outgoing handover thresholdcrossing alert, alarm component 220 can send a message directed toservice personal, technician(s), etc., e.g., alerting the servicepersonal, technician(s), etc. to perform root cause analysis of theanomalous cell relation(s), e.g., to analyze determined performancemetrics corresponding to the source cell.

In another embodiment, alarm component 220 can analyze, based on theoutgoing handover threshold crossing alert, the performance and/orservice metrics, e.g., determining whether there is a problem with abackbone, communication link(s), etc. of an associated network,determining whether maintenance was performed, recently performed, etc.on a set of eNodeBs corresponding to the source cell, etc.

In an embodiment illustrated by FIG. 4, data component 210 can generatedata corresponding to plots 410-440 associated with EUTRAN cells,sectors, etc. of a source eNodeB. Plot 410 represents a number of dailyoutgoing handover failures at the source eNodeB corresponding toneighboring ANR created EUTRAN cells. Further, plots 420-440 represent anumber of daily outgoing handover failures at respective EUTRAN cells,sectors, etc. of the source eNodeB. In this regard, alarm component 220can generate the outgoing handover threshold crossing alert in responseto determining that the number of daily outgoing handover failuresduring a period of time at one of the EUTRAN cells, sectors, etc.exceeds, is above, etc. a respective UCL that can be computed by alarmcomponent 220 per Equation 4 above.

In another embodiment illustrated by FIG. 5, data component 210 cangenerate data corresponding to plots 510-540 associated with EUTRANcells, sectors, etc. of a source eNodeB. Plot 510 represents astandardized entropy of a probability distribution of handover outcomeat the source eNodeB. Further, plots 520-540 represent standardizedentropies of probability distributions of handover outcomes atrespective EUTRAN cells, sectors, etc. of the source eNodeB. In thisregard, alarm component 220 can generate the threshold crossing alert inresponse to determining that the standardized entropy of the probabilitydistribution of outgoing handover outcome at one of the EUTRAN cells,sectors, etc. exceeds, is above, etc. a respective UCL that can becomputed by alarm component 220 per Equation 4 above.

Although not illustrated, it should be appreciated, in one embodiment,that data component 210 can generate data associated with EUTRAN cells,sectors, etc. of a source eNodeB corresponding to standardized entropiescalculated on probability distributions of failures of outgoinghandovers given EUTRAN cell neighboring cell relations with respect tothe EUTRAN cells, sectors, etc. of the source eNodeB, e.g., in responseto determining that such probability distributions include data pointsare below respective LCL levels that can be computed by alarm component220 per Equation 5 above.

In yet another embodiment, in response to determining that the outgoinghandover threshold crossing alert was generated based on the determinedcondition, e.g., in response to determining that the standardizedentropy calculated on the probability distribution of the failures ofthe outgoing handovers by given EUTRAN cell neighboring cell relation isbelow LCL 328, alarm component 220 can identify a dominant cellrelation, e.g., a heavy-hitter neighbor cell relation, of the anomalouscell relation(s) corresponding to the time series of the failures of theoutgoing handovers.

In one embodiment, alarm component 220 can determine, identify, etc. theheavy-hitter neighbor cell relation by employing entropy basedclustering/extraction. In this regard, alarm component 220 assumes thatthe probability distribution of the possible values obeys a power law,so that only a relatively few values have significantly largerprobabilities while remaining values are close to being uniformlydistributed when extracting a set of significant neighbor cellrelations. For example, alarm component 220 begins the entropy-basedclustering/extraction procedure with selection of an initial thresholdfor selecting neighbor cell relations whose handover failure share a isgreater than an initial threshold value, α₀, e.g., α₀=0.1.

In response to the standardized entropy of the remaining neighbor cellrelations being determined to be less than a threshold β, approximatinga uniform distribution, e.g., β=0.75, alarm component 220 examines eachneighbor cell relation to determine whether such neighbor cellrelation's handover failure share exceeds the relation handover failureshare threshold value. In response to alarm component 220 determiningthat the neighbor cell relation's handover failure share exceeds therelation handover failure share threshold value, alarm component 220includes the neighbor cell relation in a set of significant failingneighbor cell relations.

Further, alarm component 220 can reduce the threshold value α by anexponentially decreasing factor, e.g., 2^(−k), following each iterationk. Alarm component 220 terminates the procedure in response todetermining remaining non-clustered neighbor cell relations have aprobability distribution that is approximately uniform, e.g., H_(s)>β.Thus, neighbor cell relations within the resulting cluster areconsidered by alarm component 220 to represent heavy-hitter neighborcell relations with respect to handover failures corresponding to anassociated eNodeB.

In one embodiment, Table 1 illustrates pseudo-code representing anentropy-based clustering/extraction algorithm,

TABLE 1  1 Parameters: α:=α₀; β:= β₀;  2 Initialization: S:=NULL; R:=A;k:=0; Compute P_(A)=P(a_(i))  3 Compute P_(R); Compute θ:=H_(S)(P_(R)) 4 while θ ≤ β do  5 α= αX2 ^(−k); k++  6 for each a_(i) ε R do  7 if(P_(A)(a _(i) ) ≥α) then  8 S:=S U { a _(i) }; R:=R−{ a _(i)}  9 end if10 end for 11 Compute P_(R); Compute θ:=H_(S)(P_(R)) 12 End while

in which α is the threshold value for selecting heavy-hitter neighborrelations, and a heavy-hitter neighbor relation is a neighbor relation,neighbor cell relation, etc. whose handover failure share is greaterthan or equal to the threshold value specified by α;

α₀ is the initial specified a value;

β is the threshold standardized entropy value used to determine that thestandardized entropy calculated on the probability distribution ofhandover failure share among the non-clustered or residual neighborrelations is a uniform probability distribution, e.g., θ=HS(PR); θ>β, sothat algorithm can terminate, e.g., leave the while loop in step #12;

β₀ is the specified threshold value for β;

S is the set of clustered neighbor relations, e.g., the set ofheavy-hitter neighbor relations;

R is the residual set or the set of non-clustered neighbor relations,e.g., neighbor relations that exhibit failed handovers, but that are notclassified as heavy-hitters;

A is the set of all neighbor relations that have failed handovers;

a_(i) is a specific neighbor relation with failed handovers within setA;

PA(a_(i)) is the failure share of a_(i) in set A;

PR is the failure share of a_(i) in set R;

HS(PR) is the standardized entropy calculated on the probabilitydistribution of handover failure share among the non-clustered, orresidual, neighbor relations; and

θ is the standardized entropy calculated on a probability distribution.

In another embodiment, alarm component 220 can utilize a non-parametricoutlier detection technique to identify “heavy hitter” failing neighborcell relations. For example, the distribution of handover failuresassociated with neighbor cell relations at time t can be analyzed. Inthis regard, neighbor cell relations whose handover failure volumeexceeds Q3+C₃*(Q3−Q1)—in which C₃>=1.5, Q3 represents the third quartile(a 75^(th) percentile of handover failure volume), and Q1 represents thefirst quartile (a 25^(th) percentile of handover failure volume)—can beconsidered by alarm component 220 to be outlier observations and hence“heavy hitter” failing neighbor cell relations.

In an embodiment, in response to identifying the heavy-hitter neighborcell relation, alarm component 220 can receive incoming handover datarepresenting a daily, hourly, etc. time series of failures of incominghandovers corresponding to a target wireless access point device, targeteNodeB, etc.—the heavy-hitter neighbor cell relation including a sourcecell of the source eNodeB and a target cell of the target eNodeB.

In one embodiment, alarm component 220 can quantify the time seriesbased on an incoming handover volume metric corresponding to the daily,hourly, etc. time series of the failures of the incoming handovers,e.g., with respect to a total number of incoming handover failures ofEUTRAN cells of the target eNodeB that occur during a determined periodof time, e.g., day, week, etc.

In another embodiment, alarm component 220 can quantify the time seriesbased on an incoming handover standardized entropy metric correspondingto a standardized entropy calculated on a probability distribution ofthe failures of the incoming handovers by determined relations betweenthe target cell and the source cells, e.g., by a given EUTRAN cellneighboring cell relation.

In yet another embodiment, alarm component 220 can quantify the timeseries based on an incoming handover standardized entropy metriccorresponding to a standardized entropy calculated on a probabilitydistribution of determined incoming handover outcomes, dispositions,etc., e.g., pass/fail.

In an embodiment, alarm component 220 can generate, based on theincoming handover data, the daily, hourly, etc. time series of failuresof the incoming handovers, and analyze such time series with respect toweekly/daily periodicity, e.g., with respect to daily/hourly variationof incoming handover failures within a week/day.

In one embodiment, alarm component 220 can generate, based on theincoming handover data, a daily, hourly, etc. time series associatedwith the incoming handover standardized entropy metric corresponding tothe standardized entropy calculated on the probability distribution ofthe failures of the incoming handovers by given EUTRAN cell neighboringcell relation, and analyze such time series with respect to weekly/dailyperiodicity, e.g., with respect to a daily/hourly variation of suchstandardized entropy metric within a week/day.

In yet another embodiment, alarm component 220 can generate, based onthe incoming handover data, a daily, hourly, etc. time series of theincoming handover standardized entropy metric corresponding to thestandardized entropy calculated on the probability distribution ofdetermined incoming handover outcomes, and analyze such time series withrespect to weekly/daily periodicity, e.g., with respect to adaily/hourly variation of such standardized entropy metric within aweek/day.

In one embodiment, alarm component 220 can generate an incoming handoverthreshold crossing alert representing an existence of the anomalous cellrelation(s) corresponding to the time series of the failures of theincoming handovers based a determined condition corresponding to theincoming handover volume metric, the incoming handover standardizedentropy metric corresponding to the standardized entropy calculated onthe probability distribution of the failures of the incoming handoversby given EUTRAN cell neighboring cell relation, and/or the incominghandover standardized entropy metric corresponding to the standardizedentropy calculated on the probability distribution of determinedincoming handover outcomes.

In another embodiment, alarm component 220 can generate the incominghandover threshold-crossing alert using a seasonal decomposition of thedaily, hourly, etc. time series of failures of the incoming handovers,of the standardized entropy metric(s) discussed above, etc. using LOESSsmoothing procedures. For example, the system can generate the incominghandover threshold-crossing alert based on detected upward and/ordownward spikes in data generated by the LOESS smoothing procedures.

Now referring to an embodiment illustrated by FIG. 6, in response togenerating the incoming handover threshold crossing alert, alarmcomponent 220 can correlate outgoing handover threshold crossingalert(s) corresponding to the source cell, source eNodeB, source EUTRANcell, etc. with incoming handover threshold crossing alert(s)corresponding to the target cell, target eNodeB, target EUTRAN cell,etc. with respect to a time period.

In various embodiments, alarm component 220 can determine whether allincoming handovers fail at the target eNodeB; whether all incominghandovers fail at the target EUTRAN cell during a time corresponding toan outgoing handover threshold crossing alert corresponding to thesource cell, source eNodeB, source EUTRAN cell, etc.; whether allincoming handovers from a source EUTRAN cell fail; and/or whether allincoming handovers from the source EUTRAN cell to the target EUTRAN cellfail.

For example, alarm component 220 can correlate outgoing handoverthreshold crossing alert(s) 612, 614, 616, etc. of respective timeperiods, which correspond to determinations that the standardizedentropy of the probability distribution of outgoing handover failures ateNodeB CCL00420 by EUTRAN cell relation share is below LCL 618 (perEquation 5 above), with incoming handover threshold crossing alert(s)622, 624, 626, etc. of the respective time periods, which correspond todeterminations that the standardized entropy of the probabilitydistribution of incoming handover failures at eNodeB CCL05417 by EUTRANcell relation share is below LCL 628 (per Equation 5 above).

In embodiments illustrated by FIG. 7, alarm component 220 can correlateoutgoing handover threshold crossing alert(s) 714, 724, etc. of a timeperiod, which correspond, respectively, to a determination that thenumber of outgoing daily handover over failures at eNodeB CCL00420 toneighboring EUTRAN cells is above UCL 718 (per Equation 4 above), and toa determination that the standardized entropy of the probabilitydistribution of outgoing handover outcome is above UCL 728 (per Equation4 above), with incoming handover threshold crossing alerts 734, 744,etc. of the time period, which correspond, respectively, to adetermination that the number of daily incoming handover failures ateNodeB CCL00420 to neighboring EUTRAN cells is above UCL 738 (perEquation 4 above), and to a determination that a standardized entropy ofa probability distribution of incoming handover outcome is above UCL 748(per Equation 4 above).

In another embodiment, in response to correlating the outgoing handoverthreshold crossing alert(s) with the incoming handover thresholdcrossing alert(s), alarm component 220 can send a message directed toservice personal, technician(s), etc., e.g., alerting the servicepersonal, technician(s), etc. to analyze determined performance metricscorresponding to the target cell, target eNodeB, target EUTRAN cell,etc, e.g., for performing a root cause analysis of the anomalous cellrelation(s) corresponding to the source cell and the target cell.

In another embodiment, in response to correlating the outgoing handoverthreshold crossing alert(s) with the incoming handover thresholdcrossing alert(s), alarm component 220 can analyze the performancemetrics corresponding to the target cell, target eNodeB, target EUTRANcell, etc., e.g., determining whether there is a problem with abackbone, communication link(s), etc. of an associated network,determining whether maintenance was performed, recently performed, etc.on a set of eNodeBs corresponding to the target cell, etc.

FIGS. 8-10 illustrate methodologies in accordance with the disclosedsubject matter. For simplicity of explanation, the methodologies aredepicted and described as a series of acts. It is to be understood andappreciated that various embodiments disclosed herein are not limited bythe acts illustrated and/or by the order of acts. For example, acts canoccur in various orders and/or concurrently, and with other acts notpresented or described herein. Furthermore, not all illustrated acts maybe required to implement the methodologies in accordance with thedisclosed subject matter. In addition, those skilled in the art willunderstand and appreciate that the methodologies could alternatively berepresented as a series of interrelated states via a state diagram orevents. Additionally, it should be further appreciated that themethodologies disclosed hereinafter and throughout this specificationare capable of being stored on an article of manufacture to facilitatetransporting and transferring such methodologies to computers. The termarticle of manufacture, as used herein, is intended to encompass acomputer program accessible from any computer-readable device, carrier,or media.

Referring now to FIGS. 8-10, processes 800 to 1000 performed bysystem(s) and/or component(s) described herein, e.g., handover anomalycorrelation system 130, are illustrated, in accordance with variousembodiments. At 810, data representing a daily, hourly, etc. time seriesof failures of outgoing handovers corresponding to source NodeB, e.g.,corresponding to a EUTRAN cell of the source eNodeB, corresponding toEUTRAN cells of the source eNodeB, etc. can be received, e.g., by asystem comprising a processor. At 820, the daily, hourly, etc. timeseries of the failures of the outgoing handovers can be generated by thesystem. At 830, the daily, hourly, etc. time series can be analyzed bythe system with respect to weekly/daily periodicity. At 840, the daily,hourly, etc. time series can be quantified based on a metric, e.g.,based on the volume metric, the standardized entropy metriccorresponding to the standardized entropy calculated on the probabilitydistribution of the failures of the outgoing handovers by given EUTRANcell neighboring cell relation, the standardized entropy metriccorresponding to the standardized entropy calculated on the probabilitydistribution of determined outgoing handover outcomes, and/or LOESSsmoothing procedures.

At 910, it can be determined, by the system, whether athreshold-crossing alert has been generated, e.g., in response to adetermination that the number of daily outgoing handover failures duringa period of time, e.g., a day, exceeds, is above, etc. UCL (see Equation4 above); in response to a determination that the standardized entropyof the probability distribution of outgoing handover failures by EUTRANcell relation share is below LCL (see Equation 5 above); in response toa determination that the standardized entropy of the probabilitydistribution of outgoing handover outcome is above UCL (see Equation 4above).

If it is determined that the threshold crossing alert has beengenerated, flow continues to 920, at which performance and/or assurancemetric(s) corresponding to the source eNodeB can be analyzed, e.g., bythe system, which can perform root cause analysis of a handover failureanomaly associated with the source eNodeB; otherwise flow returns to910. In another embodiment, the system can send a message to servicepersonal, technician(s), etc., e.g., alerting the service personal,technician(s), etc. to perform the root cause analysis of anomalous cellrelation(s), e.g., to analyze determined performance metricscorresponding to the source cell.

At 930, if it is determined, by the system, that the threshold crossingalert indicates that the current observed standardized entropycalculated on the probability distribution of handover failure share byrelation is less than LCL (see Equation 5 above), flow continues to1010; otherwise flow returns to 920. At 1010, a heavy hitter neighborcell relation corresponding to the source eNodeB and a target eNodeB canbe determined by the system, e.g., by employing entropy based clusteringand/or non-parametric outlier detection techniques. At 1020, a daily,hourly, etc. time series corresponding to failures of incoming handoversat the target eNodeB can be created by the system.

At 1030, if it is determined, by the system, that incoming handoverthreshold crossing alert(s) associated with such time seriescorresponding to the failures of the incoming handovers correlate withoutgoing handover threshold-crossing alert(s) corresponding to thesource eNodeB with respect to a period of time, flow continues to 1040;otherwise flow returns to 1020.

At 1040, performance and/or assurance metric(s) corresponding to thetarget eNodeB can be analyzed, e.g., by the system, by servicepersonal/technician(s) in response to the system sending a message tothe service personal/technician(s), etc., e.g., for performance of rootcause analysis of one or more handover failure anomalies associated withthe source eNodeB and the target eNodeB.

For example, the system can determine whether all incoming handoversfail at the target eNodeB; whether all incoming handovers fail at atarget EUTRAN cell during a time corresponding to an outgoing handoverthreshold crossing alert corresponding to the source cell, sourceeNodeB, source EUTRAN cell, etc.; whether all incoming handovers from asource EUTRAN cell fail; and/or whether all incoming handovers from thesource EUTRAN cell to the target EUTRAN cell fail.

As it employed in the subject specification, the term “processor” canrefer to substantially any computing processing unit or devicecomprising, but not limited to comprising, single-core processors;single-processors with software multithread execution capability;multi-core processors; multi-core processors with software multithreadexecution capability; multi-core processors with hardware multithreadtechnology; parallel platforms; and parallel platforms with distributedshared memory. Additionally, a processor can refer to an integratedcircuit, an application specific integrated circuit (ASIC), a digitalsignal processor (DSP), a field programmable gate array (FPGA), aprogrammable logic controller (PLC), a complex programmable logic device(CPLD), a discrete gate or transistor logic, discrete hardwarecomponents, or any combination thereof designed to perform the functionsand/or processes described herein. Processors can exploit nano-scalearchitectures such as, but not limited to, molecular and quantum-dotbased transistors, switches and gates, in order to optimize space usageor enhance performance of mobile devices. A processor may also beimplemented as a combination of computing processing units.

In the subject specification, terms such as “store,” “data store,” datastorage,” “database,” and substantially any other information storagecomponent relevant to operation and functionality of a component and/orprocess, refer to “memory components,” or entities embodied in a“memory,” or components comprising the memory. It will be appreciatedthat the memory components described herein can be either volatilememory or nonvolatile memory, or can include both volatile andnonvolatile memory.

By way of illustration, and not limitation, nonvolatile memory, forexample, can be included in non-volatile memory 1122 (see below), diskstorage 1124 (see below), and/or memory storage 1146 (see below).Further, nonvolatile memory can be included in read only memory (ROM),programmable ROM (PROM), electrically programmable ROM (EPROM),electrically erasable ROM (EEPROM), or flash memory. Volatile memory1120 can include random access memory (RAM), which acts as externalcache memory. By way of illustration and not limitation, RAM isavailable in many forms such as synchronous RAM (SRAM), dynamic RAM(DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM),enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and direct Rambus RAM(DRRAM). Additionally, the disclosed memory components of systems ormethods herein are intended to comprise, without being limited tocomprising, these and any other suitable types of memory.

In order to provide a context for the various aspects of the disclosedsubject matter, FIG. 11, and the following discussion, are intended toprovide a brief, general description of a suitable environment in whichthe various aspects of the disclosed subject matter can be implemented.While the subject matter has been described above in the general contextof computer-executable instructions of a computer program that runs on acomputer and/or computers, those skilled in the art will recognize thatvarious embodiments disclosed herein can be implemented in combinationwith other program modules. Generally, program modules include routines,programs, components, data structures, etc. that perform particulartasks and/or implement particular abstract data types.

Moreover, those skilled in the art will appreciate that the inventivesystems can be practiced with other computer system configurations,including single-processor or multiprocessor computer systems,mini-computing devices, mainframe computers, as well as personalcomputers, hand-held computing devices (e.g., PDA, phone, watch),microprocessor-based or programmable consumer or industrial electronics,and the like. The illustrated aspects can also be practiced indistributed computing environments where tasks are performed by remoteprocessing devices that are linked through a communications network;however, some if not all aspects of the subject disclosure can bepracticed on stand-alone computers. In a distributed computingenvironment, program modules can be located in both local and remotememory storage devices.

With reference to FIG. 11, a block diagram of a computing system 1100operable to execute the disclosed systems and methods is illustrated, inaccordance with an embodiment. In other embodiments, functions,operations, etc. operable to execute the disclosed systems and methodscan be implemented via a virtual computing environment. Computer 1112includes a processing unit 1114, a system memory 1116, and a system bus1118. System bus 1118 couples system components including, but notlimited to, system memory 1116 to processing unit 1114. Processing unit1114 can be any of various available processors. Dual microprocessorsand other multiprocessor architectures also can be employed asprocessing unit 1114.

System bus 1118 can be any of several types of bus structure(s)including a memory bus or a memory controller, a peripheral bus or anexternal bus, and/or a local bus using any variety of available busarchitectures including, but not limited to, industrial standardarchitecture (ISA), micro-channel architecture (MSA), extended ISA(EISA), intelligent drive electronics (IDE), VESA local bus (VLB),peripheral component interconnect (PCI), card bus, universal serial bus(USB), advanced graphics port (AGP), personal computer memory cardinternational association bus (PCMCIA), Firewire (IEEE 1394), smallcomputer systems interface (SCSI), and/or controller area network (CAN)bus used in vehicles.

System memory 1116 includes volatile memory 1120 and nonvolatile memory1122. A basic input/output system (BIOS), containing routines totransfer information between elements within computer 1112, such asduring start-up, can be stored in nonvolatile memory 1122. By way ofillustration, and not limitation, nonvolatile memory 1122 can includeROM, PROM, EPROM, EEPROM, or flash memory. Volatile memory 1120 includesRAM, which acts as external cache memory. By way of illustration and notlimitation, RAM is available in many forms such as SRAM, dynamic RAM(DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM),enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), Rambus direct RAM(RDRAM), direct Rambus dynamic RAM (DRDRAM), and Rambus dynamic RAM(RDRAM).

Computer 1112 also includes removable/non-removable,volatile/non-volatile computer storage media. FIG. 11 illustrates, forexample, disk storage 1124. Disk storage 1124 includes, but is notlimited to, devices like a magnetic disk drive, floppy disk drive, tapedrive, Jaz drive, Zip drive, LS-100 drive, flash memory card, or memorystick. In addition, disk storage 1124 can include storage mediaseparately or in combination with other storage media including, but notlimited to, an optical disk drive such as a compact disk ROM device(CD-ROM), CD recordable drive (CD-R Drive), CD rewritable drive (CD-RWDrive) or a digital versatile disk ROM drive (DVD-ROM). To facilitateconnection of the disk storage devices 1124 to system bus 1118, aremovable or non-removable interface is typically used, such asinterface 1126.

It is to be appreciated that FIG. 11 describes software that acts as anintermediary between users and computer resources described in suitableoperating environment 1100. Such software includes an operating system1128. Operating system 1128, which can be stored on disk storage 1124,acts to control and allocate resources of computer system 1112. Systemapplications 1130 take advantage of the management of resources byoperating system 1128 through program modules 1132 and program data 1134stored either in system memory 1116 or on disk storage 1124. It is to beappreciated that the disclosed subject matter can be implemented withvarious operating systems or combinations of operating systems.

A user can enter commands or information into computer 1112 throughinput device(s) 1136. Input devices 1136 include, but are not limitedto, a pointing device such as a mouse, trackball, stylus, touch pad,keyboard, microphone, joystick, game pad, satellite dish, scanner, TVtuner card, digital camera, digital video camera, web camera, cellularphone, user equipment, smartphone, and the like. These and other inputdevices connect to processing unit 1114 through system bus 1118 viainterface port(s) 1138. Interface port(s) 1138 include, for example, aserial port, a parallel port, a game port, a universal serial bus (USB),a wireless based port, e.g., Wi-Fi, Bluetooth, etc. Output device(s)1140 use some of the same type of ports as input device(s) 1136.

Thus, for example, a USB port can be used to provide input to computer1112 and to output information from computer 1112 to an output device1140. Output adapter 1142 is provided to illustrate that there are someoutput devices 1140, like display devices, light projection devices,monitors, speakers, and printers, among other output devices 1140, whichuse special adapters. Output adapters 1142 include, by way ofillustration and not limitation, video and sound devices, cards, etc.that provide means of connection between output device 1140 and systembus 1118. It should be noted that other devices and/or systems ofdevices provide both input and output capabilities such as computer(s)1144, e.g., network equipment, devices, etc.

Computer 1112 can operate in a networked environment using logicalconnections to one or more remote computers, such as computer(s) 1144.Computer(s) 1144 can be a personal computer, a server, a router, anetwork PC, a workstation, a microprocessor based appliance, a peerdevice, or other common network node and the like, and typicallyincludes many or all of the elements described relative to computer1112.

For purposes of brevity, only a memory storage device 1146 isillustrated with computer(s) 1144. Computer(s) 1144 is logicallyconnected to computer 1112 through a network interface 1148 and thenphysically and/or wirelessly connected via communication connection1150. Network interface 1148 encompasses wire and/or wirelesscommunication networks such as local-area networks (LAN) and wide-areanetworks (WAN). LAN technologies include fiber distributed datainterface (FDDI), copper distributed data interface (CDDI), Ethernet,token ring and the like. WAN technologies include, but are not limitedto, point-to-point links, circuit switching networks like integratedservices digital networks (ISDN) and variations thereon, packetswitching networks, and digital subscriber lines (DSL). In oneembodiment, network interface 1148 can serve as a line card withincomputer 1112, e.g., for communicating between devices of differentnetworks, different network interfaces, etc.

Communication connection(s) 1150 refer(s) to hardware/software employedto connect network interface 1148 to bus 1118. While communicationconnection 1150 is shown for illustrative clarity inside computer 1112,it can also be external to computer 1112. The hardware/software forconnection to network interface 1148 can include, for example, internaland external technologies such as modems, including regular telephonegrade modems, cable modems and DSL modems, wireless modems, ISDNadapters, and Ethernet cards.

The computer 1112 can operate in a networked environment using logicalconnections via wired and/or wireless communications to one or moreremote computers, cellular based devices, user equipment, smartphones,or other computing devices, such as workstations, server computers,routers, personal computers, portable computers, microprocessor-basedentertainment appliances, peer devices or other common network nodes,etc. The computer 1112 can connect to other devices/networks by way ofantenna, port, network interface adaptor, wireless access point, modem,and/or the like.

The computer 1112 is operable to communicate with any wireless devicesor entities operatively disposed in wireless communication, e.g., aprinter, scanner, desktop and/or portable computer, portable dataassistant, communications satellite, user equipment, cellular basedevice, smartphone, any piece of equipment or location associated with awirelessly detectable tag (e.g., scanner, a kiosk, news stand,restroom), and telephone. This includes at least Wi-Fi and Bluetoothwireless technologies. Thus, the communication can be a predefinedstructure as with a conventional network or simply an ad hoccommunication between at least two devices.

Wi-Fi allows connection to the Internet from a desired location (e.g., avehicle, couch at home, a bed in a hotel room, or a conference room atwork, etc.) without wires. Wi-Fi is a wireless technology similar tothat used in a cell phone that enables such devices, e.g., mobilephones, computers, etc., to send and receive data indoors and out,anywhere within the range of a base station. Wi-Fi networks use radiotechnologies called IEEE 802.11 (a, b, g, etc.) to provide secure,reliable, fast wireless connectivity. A Wi-Fi network can be used toconnect communication devices (e.g., mobile phones, computers, etc.) toeach other, to the Internet, and to wired networks (which use IEEE 802.3or Ethernet). Wi-Fi networks operate in the unlicensed 2.4 and 5 GHzradio bands, at an 11 Mbps (802.11a) or 54 Mbps (802.11b) data rate, forexample, or with products that contain both bands (dual band), so thenetworks can provide real-world performance similar to the basic 10BaseTwired Ethernet networks used in many offices.

The above description of illustrated embodiments of the subjectdisclosure, including what is described in the Abstract, is not intendedto be exhaustive or to limit the disclosed embodiments to the preciseforms disclosed. While specific embodiments and examples are describedherein for illustrative purposes, various modifications are possiblethat are considered within the scope of such embodiments and examples,as those skilled in the relevant art can recognize.

In this regard, while the disclosed subject matter has been described inconnection with various embodiments and corresponding Figures, whereapplicable, it is to be understood that other similar embodiments can beused or modifications and additions can be made to the describedembodiments for performing the same, similar, alternative, or substitutefunction of the disclosed subject matter without deviating therefrom.Therefore, the disclosed subject matter should not be limited to anysingle embodiment described herein, but rather should be construed inbreadth and scope in accordance with the appended claims below.

What is claimed is:
 1. A method, comprising: receiving, by a systemcomprising a processor, data representing a first time series offailures of outgoing handovers corresponding to a wireless access pointdevice, wherein the outgoing handovers are outbound communicationtransfers from a source cell of the wireless access point device totarget cells; and in response to determining, by the system, that thesource cell and a target cell of the target cells comprise a firstanomalous relation represented by a first defined condition with respectto a first probability distribution corresponding to the outgoinghandovers, sending, by the system, a message, directed to a device,identifying the first anomalous relation to facilitate removal of thefirst anomalous cell relation, from a data store, identifying the targetcell as a handover candidate.
 2. The method of claim 1, wherein thefirst probability distribution represents a volume of the failures ofthe outgoing handovers during a period of time.
 3. The method of claim1, wherein the first probability distribution represents the failures ofthe outgoing handovers by determined relations between the source celland the target cells.
 4. The method of claim 1, wherein the firstprobability distribution represents determined outgoing handoveroutcomes.
 5. The method of claim 1, wherein the determining comprises:determining, based on a logarithm associated with the first time seriesof the failures, a first entropy over the first probability distributioncorresponding to the outgoing handovers by first determined relationsbetween the source cell and the target cells; and determining whetherthe first entropy satisfies the first defined condition.
 6. The methodof claim 5, further comprising: in response to determining that thefirst entropy satisfies the first defined condition, determining, by thesystem, that the first anomalous relation is a dominant relation usingentropy based clustering.
 7. The method of claim 5, further comprising:in response to determining that the first entropy satisfies the firstdefined condition, determining, by the system, that the first anomalousrelation is a dominant relation using non-parametric outlier detection.8. The method of claim 5, further comprising: in response to determiningthat the first anomalous relation is a dominant relation, receiving, bythe system, incoming handover data representing a second time series offailures of incoming handovers corresponding to the target cell, whereinthe incoming handovers are incoming communication transfers from sourcecells comprising the source cell to the target cell; and determining, bythe system, that the target cell and a selected source cell of thesource cells comprise a second anomalous relation represented by asecond defined condition with respect to the incoming handovers.
 9. Themethod of claim 8, wherein the incoming handover data represents avolume of the failures of the incoming handovers during a period oftime.
 10. The method of claim 8, wherein the incoming handover datarepresents a second entropy that has been determined on a secondprobability distribution of the failures of the incoming handovers bysecond determined relations between the target cell and the sourcecells.
 11. The method of claim 8, wherein the incoming handover datarepresents a second entropy that has been determined on a secondprobability distribution of determined incoming handover outcomes. 12.The method of claim 8, further comprising: in response to thedetermining the second anomalous relation, correlating, by the system,the first anomalous relation with the second anomalous relation.
 13. Asystem, comprising: a processor; and a memory that stores executableinstructions that, when executed by the processor, facilitateperformance of operations, comprising: receiving data representing atime series of failures of outgoing handovers corresponding to a sourcedevice, wherein the outgoing handovers comprise outbound communicationtransfers from a source cell device of the source device to target celldevices; and in response to determining that an anomalous relationcomprising the source cell device and a target cell device of the targetcell devices satisfies a defined condition with respect to a probabilitydistribution of the outgoing handovers, removing the anomalous relationfrom a data store identifying the target cell device as an outgoinghandover candidate.
 14. The system of claim 13, wherein the probabilitydistribution represents a volume of the failures of the outgoinghandovers during a period of time.
 15. The system of claim 13, whereinthe probability distribution represents the failures of the outgoinghandovers by determined relations between the source cell device and thetarget cell devices.
 16. The system of claim 13, wherein the probabilitydistribution represents determined outgoing handover outcomes.
 17. Thesystem of claim 13, wherein the defined condition represents thefailures of the outgoing handovers by determined relations between thesource cell device and the target cell devices.
 18. A machine-readablestorage medium, comprising executable instructions that, when executedby a processor, facilitate performance of operations, comprising:receiving data representing a time series of failures of outgoinghandovers corresponding to a source device, wherein the outgoinghandovers comprise outbound communication transfers from a source celldevice of the source device to target cell devices; in response toquantifying the time series over a probability distribution of theoutgoing handovers, identifying that the source cell device and a targetcell device of the target cell devices are associated with an anomaloushandover failure condition; and removing the source cell device and thetarget cell device from a data store identifying the target cell deviceas a candidate for an outgoing handover.
 19. The machine-readablestorage medium of claim 18, wherein the probability distributionrepresents the failures of the outgoing handovers by determinedrelations between the source cell device and the target cell devices.20. The machine-readable storage medium of claim 19, wherein theidentifying comprises: determining, based on a logarithm correspondingto the time series of failures, an entropy over the probabilitydistribution of the outgoing handovers; and in response to determiningthat the entropy satisfies a determined metric with respect todetermined relations between the source cell device and the target celldevices, identifying that the source cell device and the target celldevice comprise an anomalous relation using entropy based clustering.